Overview

overview

10

Static

static

10

0b07cb9f28...bf.exe

windows7_x64

10

0b07cb9f28...bf.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0b07cb9f28806e64db383edc78c90c70ecbc990379536856e91efdab226876bf

  • Size

    92KB

  • Sample

    220212-kcktxaaah4

  • MD5

    9076e34144cf5f5eb8f637160f8cf43d

  • SHA1

    6e1fd42383124664d267181f348dd0318119639e

  • SHA256

    0b07cb9f28806e64db383edc78c90c70ecbc990379536856e91efdab226876bf

  • SHA512

    d2bce031d397f8a218ebab202e36eb3e1291e898d361f7dddeefdb1bf81ec910bf53fdf99fff0861d59ea9c7ecc54fc58b9f483d728f69170e1031b15db88fe5

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0b07cb9f28806e64db383edc78c90c70ecbc990379536856e91efdab226876bf

    • Size

      92KB

    • MD5

      9076e34144cf5f5eb8f637160f8cf43d

    • SHA1

      6e1fd42383124664d267181f348dd0318119639e

    • SHA256

      0b07cb9f28806e64db383edc78c90c70ecbc990379536856e91efdab226876bf

    • SHA512

      d2bce031d397f8a218ebab202e36eb3e1291e898d361f7dddeefdb1bf81ec910bf53fdf99fff0861d59ea9c7ecc54fc58b9f483d728f69170e1031b15db88fe5

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks